We have a B2C tenant that uses openID and custom user flows.
Now I’m trying to add a SAML application to it. So the B2C will serve as an IdP and the SAML application as SP.

I’ve managed to configure it according to Microsoft guide and everything is running fine. The problem is when I try to send the “email” claim to Microsft test app that I use for testing https://samltestapp2.azurewebsites.net.

We are using both Local and Social accounts. As you know the email claim for Local accounts is “signInNames.emailAddress” and for Social we are using “email” (not “emails”!) claim to send only one email as string.

For openID app that we use we are sending the claims in this way and it’s working. When the user is Local it sends only the populated claim, and for the Socail is the same:

      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="displayName" />
        <OutputClaim ClaimTypeReferenceId="email" />
        <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="sub" />

When I try to use the same structure for the SAML app (testing with https://samltestapp2.azurewebsites.net/) I’m getting error “Unhandled Error”.

If I use only one of the “email” claims everithing works fine for the corresponding account type, but as we have both types of accounts this is not an option.

If I track the SAML request and response, I can see in the respose the “email” attribute is there even the site throws an error:

        </saml:AuthnStatement>
        <saml:AttributeStatement 
            xmlns:xs="http://www.w3.org/2001/XMLSchema">
            <saml:Attribute 
                Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" 
                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" 
                FriendlyName="Display Name">
                <saml:AttributeValue 
                    xsi:type="xs:string">First LastName
                </saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute 
                Name="email" 
                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" 
                FriendlyName="Email Address">
                <saml:AttributeValue 
                    xsi:type="xs:string">[email protected]
                </saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute 
                Name="email" 
                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" 
                FriendlyName="Email Address">
                <saml:AttributeValue 
                    xsi:type="xs:string">[email protected]
                </saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute 
                Name="http://schemas.microsoft.com/identity/claims/identityprovider" 
                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" 
                FriendlyName="Identity Provider">
                <saml:AttributeValue 
                    xsi:type="xs:string">https://login.microsoftonline.com/{tenantGUID}/v2.0
                </saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute 
                Name="sub" 
                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" 
                FriendlyName="User's Object ID">
                <saml:AttributeValue 
                    xsi:type="xs:string">{ObjectIDGuid}
                </saml:AttributeValue>
            </saml:Attribute>
        </saml:AttributeStatement>
    </saml:Assertion>

I also tried to modify it a little bit like bellow to change the SubjectNamingInfo from “sub” to “email” and to exclude the email claim. In this way the site doesn’t throw an error, but I preffer SubjectNamingInfo to be the “sub”

      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" />        
        <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email"/>
        <OutputClaim ClaimTypeReferenceId="email"/>
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="" />
        <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
      </OutputClaims>
      <SubjectNamingInfo ClaimType="email" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" ExcludeAsClaim="true"/>

I was wondering if this can be some bug in the MS test app or I’m doing something wrong?